cardioailive1/Ghana_digital_health

Cardio AI Ghana Digital Health Platform — A full-stack clinical intelligence system for Ghana's 2,070+ GHS facilities. Features AI-powered clinical decision support. IoMT real-time monitoring (NEWS2/SOFA/HELLP/PELOD-2), NHIS billing automation, ICD-11 native coding, HL7 FHIR R4, DHIS2 integration, CHPS offline-first architecture, and GHIMS interop # Cardio AI Ghana Digital Health Platform v3.0 ### Render.com Deployment | HIPAA · SOC 2 · OAuth 2.0 · RBAC ## Quick Deploy to Render.com 1. Push this repo to GitHub 2. In Render Dashboard → **New Web Service** → connect repo 3. Set **Build Command**: `npm install && npm run build` 4. Set **Start Command**: `npm start` 5. Add Environment Variables (see below) ## Required Environment Variables (Render Dashboard → Environment) | Variable | Description | |---|---| | `NODE_ENV` | `production` | | `PORT` | `3001` | | `ANTHROPIC_API_KEY` | Your Anthropic API key | | `JWT_SECRET` | 256-bit random string (generate: `openssl rand -hex 32`) | | `SESSION_SECRET` | Random string | | `GOOGLE_CLIENT_ID` | Google OAuth Client ID | | `GOOGLE_CLIENT_SECRET` | Google OAuth Client Secret | | `MICROSOFT_CLIENT_ID` | Azure AD App Client ID | | `MICROSOFT_CLIENT_SECRET` | Azure AD Client Secret | | `MICROSOFT_TENANT_ID` | `common` or your tenant ID | | `CLIENT_URL` | `your-app.onrender.com` | | `ALLOWED_ORIGINS` | `your-app.onrender.com` | ## OAuth Setup ### Google Workspace 1. GCP Console → APIs & Services → Credentials → OAuth 2.0 Client ID 2. Authorized redirect URI: `your-app.onrender.com` 3. For hospital SSO: enable Google Workspace domain restriction ### Microsoft Azure AD 1. Azure Portal → App Registrations → New Registration 2. Redirect URI: `your-app.onrender.com` 3. Set Tenant ID to your hospital's Azure AD tenant for single-tenant mode ## Project Structure ``` cardio-ai-render/ ├── server/ │ ├── index.js # Express server — all middleware │ ├── auth.js # JWT + bcrypt + OAuth upsert │ ├── rbac.js # 9 roles × 24 permissions │ ├── security.js # Helmet + CORS + rate limits + CSP │ ├── logger.js # HIPAA-safe winston logger (PHI stripped) │ └── routes/ │ ├── auth.routes.js # /auth/* — login, OAuth, me, users │ └── ai.routes.js # …